F5 fixes actively exploited zero-day flaw in BIG-IP APM
F5 patched actively exploited BIG-IP APM zero-day CVE-2026-94127, a 9.8 CVSS heap overflow RCE added to CISA's KEV catalog.
F5 fixed critical remote code execution flaw CVE-2026-94127 (CVSS 9.8), a heap-based buffer overflow affecting BIG-IP APM deployments configured as OAuth authorization servers, which was actively exploited before the patch released. CISA added the zero-day to its Known Exploited Vulnerabilities catalog, and Shadowserver tracks more than 15,000 internet-exposed BIG-IP APM deployments. Hotfixes cover the 21.x, 17.5.x, and 17.1.x branches, with an iRule available as interim mitigation. F5 advises reviewing logs for repeated OAuth authentication failures, suspicious commands, and TMM SIGABRT crashes as exploitation indicators.
- CVE-2026-94127: CVSS 9.8 heap overflow in BIG-IP APM OAuth authorization server configurations
- Actively exploited before patch; added to CISA KEV catalog Tuesday
- Over 15,000 BIG-IP APM deployments exposed online per Shadowserver
- Hotfixes for 21.x, 17.5.x, 17.1.x; interim iRule mitigation available
- IOC pattern: repeated OAuth failures, suspicious commands, then TMM SIGABRT crash
Vulnerabilities mentionedAll →
- CVE-2025-53529.6<1%A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the…published · lunary lunary PoC
Full article479 words · extracted from csoonline.com · click to collapse
Technology company F5 fixed a critical remote code execution vulnerability in its BIG-IP Access Policy Manager (APM) platform on Tuesday. The flaw impacts deployments configured as OAuth authorization servers and was already under active exploitation in the wild before the patch became available.
BIG-IP APM is a software component in F5’s BIG-IP hardware platform that enables companies to control access to internal network resources. APM performs various client-side checks and handles authorization and authentication, along with providing VPN connectivity for remote users.
The flaw, tracked as CVE-2026-94127, is described as a heap-based buffer overflow and is rated 9.8 on the CVSS scale. The vulnerability impacts the BIG-IP system when configured in appliance mode as well but can be exploited only when both APM and an OAuth authorization server profile are configured.
Deployments using APM only as an OAuth client or resource server are not affected, F5 said in its advisory. The company advises users to apply Hotfix-BIGIP-21.1.0.2.0.30.22-ENG.iso for the 21.x for the 21.x release branch and Hotfix-BIGIP-17.5.1.9.0.160.12-ENG.iso or Hotfix-BIGIP 17.1.3.5.0.41.14-ENG.iso for the still supported 17.5.x and 17.1.x branches.
In addition to the fixes, F5 also released an iRule that can be obtained from the support portal and can be deployed as mitigation until the patch gets applied.
Check for OAuth failures
The US Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, signaling confirmed active exploitation in the wild. The Shadowserver Foundation tracks more than 15,000 BIG-IP APM deployments exposed to the internet, with North America and Europe accounting for around 5,000 each.
F5 advises customers to check installations for several indicators of compromise that require correlation as the presence of just one is not necessarily a sign of exploitation.
“At a high level, multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT is the combination that should lead to human review of the system,” the company said.
OAuth authentication failures are not unusual, but a repetition of more than 10 such messages in the logs, especially originating from the same IP address, should be reason for further investigation. The following command can reveal the number of authentication failures: tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed
If suspicious counts of OAuth messages are noticed, administrators should review the information recorded around those timestamps in /var/log/audit, as well as the presence of TMM core files because exploitation can cause the TMM to enter a loop and crash, generating such files.
BIG-IP APM and other F5 devices and appliances have been targeted by attackers over the past few years as part of a larger trend of compromising network edge devices and VPN gateways as an entry point into corporate networks. Just earlier this month, security researchers uncovered a Linux rootkit implant specifically designed for BIG-IP APM systems that was linked to exploitation of an older vulnerability, CVE-2025-5352.